ufo - npm Package Compare versions

Comparing version 0.7.2 to 0.7.3

CHANGELOG.md

@@ -5,2 +5,15 @@ # Changelog
 
+### [0.7.3](https://github.com/unjs/ufo/compare/v0.7.2...v0.7.3) (2021-05-11)
+
+
+### Features
+
+* support query params for `trailingSlash` utils ([7655066](https://github.com/unjs/ufo/commit/7655066f6d8eee1bc7b6deae6fef76c4058b3fee)), closes [#19](https://github.com/unjs/ufo/issues/19)
+
+
+### Bug Fixes
+
+* **parseQuery:** prevent possible prototype pollution ([f4be854](https://github.com/unjs/ufo/commit/f4be854bf7ee46335fa70be170b61c6b76e0c2d3))
+* slash encode in path ([#23](https://github.com/unjs/ufo/issues/23)) ([912399f](https://github.com/unjs/ufo/commit/912399f0682974def7c9bea548f96ddab0d09659))
+
 ### [0.7.2](https://github.com/unjs/ufo/compare/v0.7.1...v0.7.2) (2021-04-28)
@@ -7,0 +20,0 @@

dist/index.d.ts

@@ -56,2 +56,9 @@ /**
 /**
+ * Decode path section of URL (consitant with encodePath for slash encoding).
+ *
+ * @param text - string to decode
+ * @returns decoded string
+ */
+declare function decodePath(text: string): string;
+/**
  * Decode query value (consitant with encodeQueryValue for plus encoding).
@@ -139,2 +146,2 @@ *
 
-export { $URL, ParsedAuth, ParsedHost, ParsedURL, QueryObject, QueryValue, cleanDoubleSlashes, createURL, decode, decodeQueryValue, encode, encodeHash, encodeHost, encodeParam, encodePath, encodeQueryItem, encodeQueryKey, encodeQueryValue, getQuery, hasLeadingSlash, hasProtocol, hasTrailingSlash, isEmptyURL, isNonEmptyURL, isRelative, isSamePath, joinURL, normalizeURL, parseAuth, parseHost, parsePath, parseQuery, parseURL, resolveURL, stringifyParsedURL, stringifyQuery, withBase, withLeadingSlash, withQuery, withTrailingSlash, withoutBase, withoutLeadingSlash, withoutTrailingSlash };
+export { $URL, ParsedAuth, ParsedHost, ParsedURL, QueryObject, QueryValue, cleanDoubleSlashes, createURL, decode, decodePath, decodeQueryValue, encode, encodeHash, encodeHost, encodeParam, encodePath, encodeQueryItem, encodeQueryKey, encodeQueryValue, getQuery, hasLeadingSlash, hasProtocol, hasTrailingSlash, isEmptyURL, isNonEmptyURL, isRelative, isSamePath, joinURL, normalizeURL, parseAuth, parseHost, parsePath, parseQuery, parseURL, resolveURL, stringifyParsedURL, stringifyQuery, withBase, withLeadingSlash, withQuery, withTrailingSlash, withoutBase, withoutLeadingSlash, withoutTrailingSlash };

dist/index.js

@@ -106,2 +106,4 @@ 'use strict';
 const ENC_SPACE_RE = /%20/g;
+const ENC_SLASH_RE = /%2F/g;
+const ENC_ENC_SLASH_RE = /%252F/g;
 function encode(text) {
@@ -120,3 +122,3 @@ return encodeURI("" + text).replace(ENC_PIPE_RE, "|").replace(ENC_BRACKET_OPEN_RE, "[").replace(ENC_BRACKET_CLOSE_RE, "]");
 function encodePath(text) {
-  return encode(text).replace(HASH_RE, "%23").replace(IM_RE, "%3F");
+  return encode(text).replace(HASH_RE, "%23").replace(IM_RE, "%3F").replace(ENC_ENC_SLASH_RE, "%2F");
 }
@@ -133,2 +135,5 @@ function encodeParam(text) {
 }
+function decodePath(text) {
+  return decode(text.replace(ENC_SLASH_RE, "%252F"));
+}
 function decodeQueryValue(text) {
@@ -152,2 +157,5 @@ return decode(text.replace(PLUS_RE, " "));
     const key = decode(s[1]);
+    if (key === "__proto__" || key === "constructor") {
+      continue;
+    }
     const value = decodeQueryValue(s[2] || "");
@@ -189,3 +197,3 @@ if (obj[key]) {
     this.auth = decode(parsed.auth);
-    this.pathname = decode(parsed.pathname);
+    this.pathname = decodePath(parsed.pathname);
     this.query = parseQuery(parsed.search);
@@ -272,10 +280,19 @@ this.hash = decode(parsed.hash);
 }
+const TRAILING_SLASH_RE = /\/$|\/\?/;
 function hasTrailingSlash(input = "") {
-  return input.endsWith("/");
+  return TRAILING_SLASH_RE.test(input);
 }
 function withoutTrailingSlash(input = "") {
-  return (hasTrailingSlash(input) ? input.slice(0, -1) : input) || "/";
+  if (!hasTrailingSlash(input)) {
+    return input || "/";
+  }
+  const [s0, ...s] = input.split("?");
+  return (s0.slice(0, -1) || "/") + (s.length ? `?${s.join("?")}` : "");
 }
 function withTrailingSlash(input = "") {
-  return input.endsWith("/") ? input : input + "/";
+  if (hasTrailingSlash(input)) {
+    return input || "/";
+  }
+  const [s0, ...s] = input.split("?");
+  return s0 + "/" + (s.length ? `?${s.join("?")}` : "");
 }
@@ -403,2 +420,3 @@ function hasLeadingSlash(input = "") {
 exports.decode = decode;
+exports.decodePath = decodePath;
 exports.decodeQueryValue = decodeQueryValue;
@@ -405,0 +423,0 @@ exports.encode = encode;

package.json

 {
   "name": "ufo",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "URL utils for humans",
@@ -5,0 +5,0 @@ "repository": "unjs/ufo",

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Deprecated

Maintenance

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Deprecated

Maintenance

The maintainer of the package marked it as deprecated. This could indicate that a single version should not be used, or that the package is no longer maintained and any new vulnerabilities will not be fixed.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

46066

increased by4.31%

Lines of code

983

increased by4.46%

No dependency changes